blob: 5c35cc8faf8f9e9170ac0918a9e40a124adc5a4f [file] [log] [blame]
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001//===-- AddressSanitizer.cpp - memory error detector ------------*- C++ -*-===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11// Details of the algorithm:
12// http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
13//
14//===----------------------------------------------------------------------===//
15
16#define DEBUG_TYPE "asan"
17
Chandler Carruthed0881b2012-12-03 16:50:05 +000018#include "llvm/Transforms/Instrumentation.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000019#include "llvm/ADT/ArrayRef.h"
Alexey Samsonov29dd7f22012-12-27 08:50:58 +000020#include "llvm/ADT/DenseMap.h"
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +000021#include "llvm/ADT/DepthFirstIterator.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000022#include "llvm/ADT/SmallSet.h"
23#include "llvm/ADT/SmallString.h"
24#include "llvm/ADT/SmallVector.h"
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +000025#include "llvm/ADT/Statistic.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000026#include "llvm/ADT/StringExtras.h"
Evgeniy Stepanov617232f2012-05-23 11:52:12 +000027#include "llvm/ADT/Triple.h"
Chandler Carruth219b89b2014-03-04 11:01:28 +000028#include "llvm/IR/CallSite.h"
Chandler Carruth12664a02014-03-06 00:22:06 +000029#include "llvm/IR/DIBuilder.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000030#include "llvm/IR/DataLayout.h"
31#include "llvm/IR/Function.h"
32#include "llvm/IR/IRBuilder.h"
33#include "llvm/IR/InlineAsm.h"
Chandler Carruth7da14f12014-03-06 03:23:41 +000034#include "llvm/IR/InstVisitor.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000035#include "llvm/IR/IntrinsicInst.h"
36#include "llvm/IR/LLVMContext.h"
Kostya Serebryany714c67c2014-01-17 11:00:30 +000037#include "llvm/IR/MDBuilder.h"
Chandler Carruth9fb823b2013-01-02 11:36:10 +000038#include "llvm/IR/Module.h"
39#include "llvm/IR/Type.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000040#include "llvm/Support/CommandLine.h"
41#include "llvm/Support/DataTypes.h"
42#include "llvm/Support/Debug.h"
Kostya Serebryany9e62b302013-06-03 14:46:56 +000043#include "llvm/Support/Endian.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000044#include "llvm/Support/system_error.h"
Kostya Serebryany4fb78012013-12-06 09:00:17 +000045#include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000046#include "llvm/Transforms/Utils/BasicBlockUtils.h"
Kostya Serebryany9f5213f2013-06-26 09:18:17 +000047#include "llvm/Transforms/Utils/Cloning.h"
Alexey Samsonov3d43b632012-12-12 14:31:53 +000048#include "llvm/Transforms/Utils/Local.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000049#include "llvm/Transforms/Utils/ModuleUtils.h"
Peter Collingbourne015370e2013-07-09 22:02:49 +000050#include "llvm/Transforms/Utils/SpecialCaseList.h"
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000051#include <algorithm>
Chandler Carruthed0881b2012-12-03 16:50:05 +000052#include <string>
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000053
54using namespace llvm;
55
56static const uint64_t kDefaultShadowScale = 3;
57static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
58static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
Kostya Serebryanycc92c792014-02-24 13:40:24 +000059static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000; // < 2G.
Kostya Serebryany4766fe62013-01-23 12:54:55 +000060static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41;
Kostya Serebryany9e62b302013-06-03 14:46:56 +000061static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa8000;
Kostya Serebryany8baa3862014-02-10 07:37:04 +000062static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
63static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000064
Kostya Serebryany6805de52013-09-10 13:16:56 +000065static const size_t kMinStackMallocSize = 1 << 6; // 64B
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000066static const size_t kMaxStackMallocSize = 1 << 16; // 64K
67static const uintptr_t kCurrentStackFrameMagic = 0x41B58AB3;
68static const uintptr_t kRetiredStackFrameMagic = 0x45E0360E;
69
Craig Topperd3a34f82013-07-16 01:17:10 +000070static const char *const kAsanModuleCtorName = "asan.module_ctor";
71static const char *const kAsanModuleDtorName = "asan.module_dtor";
72static const int kAsanCtorAndCtorPriority = 1;
73static const char *const kAsanReportErrorTemplate = "__asan_report_";
74static const char *const kAsanReportLoadN = "__asan_report_load_n";
75static const char *const kAsanReportStoreN = "__asan_report_store_n";
76static const char *const kAsanRegisterGlobalsName = "__asan_register_globals";
Alexey Samsonovf52b7172013-08-05 13:19:49 +000077static const char *const kAsanUnregisterGlobalsName =
78 "__asan_unregister_globals";
Craig Topperd3a34f82013-07-16 01:17:10 +000079static const char *const kAsanPoisonGlobalsName = "__asan_before_dynamic_init";
80static const char *const kAsanUnpoisonGlobalsName = "__asan_after_dynamic_init";
81static const char *const kAsanInitName = "__asan_init_v3";
Bob Wilsonda4147c2013-11-15 07:16:09 +000082static const char *const kAsanCovName = "__sanitizer_cov";
Kostya Serebryany796f6552014-02-27 12:45:36 +000083static const char *const kAsanPtrCmp = "__sanitizer_ptr_cmp";
84static const char *const kAsanPtrSub = "__sanitizer_ptr_sub";
Craig Topperd3a34f82013-07-16 01:17:10 +000085static const char *const kAsanHandleNoReturnName = "__asan_handle_no_return";
Kostya Serebryany6805de52013-09-10 13:16:56 +000086static const int kMaxAsanStackMallocSizeClass = 10;
87static const char *const kAsanStackMallocNameTemplate = "__asan_stack_malloc_";
88static const char *const kAsanStackFreeNameTemplate = "__asan_stack_free_";
Craig Topperd3a34f82013-07-16 01:17:10 +000089static const char *const kAsanGenPrefix = "__asan_gen_";
90static const char *const kAsanPoisonStackMemoryName =
91 "__asan_poison_stack_memory";
92static const char *const kAsanUnpoisonStackMemoryName =
Alexey Samsonov261177a2012-12-04 01:34:23 +000093 "__asan_unpoison_stack_memory";
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +000094
Kostya Serebryanyf3223822013-09-18 14:07:14 +000095static const char *const kAsanOptionDetectUAR =
96 "__asan_option_detect_stack_use_after_return";
97
David Blaikieeacc2872013-09-18 00:11:27 +000098#ifndef NDEBUG
Kostya Serebryanybc86efb2013-09-17 12:14:50 +000099static const int kAsanStackAfterReturnMagic = 0xf5;
David Blaikieeacc2872013-09-18 00:11:27 +0000100#endif
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000101
Kostya Serebryany874dae62012-07-16 16:15:40 +0000102// Accesses sizes are powers of two: 1, 2, 4, 8, 16.
103static const size_t kNumberOfAccessSizes = 5;
104
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000105// Command-line flags.
106
107// This flag may need to be replaced with -f[no-]asan-reads.
108static cl::opt<bool> ClInstrumentReads("asan-instrument-reads",
109 cl::desc("instrument read instructions"), cl::Hidden, cl::init(true));
110static cl::opt<bool> ClInstrumentWrites("asan-instrument-writes",
111 cl::desc("instrument write instructions"), cl::Hidden, cl::init(true));
Kostya Serebryany90241602012-05-30 09:04:06 +0000112static cl::opt<bool> ClInstrumentAtomics("asan-instrument-atomics",
113 cl::desc("instrument atomic instructions (rmw, cmpxchg)"),
114 cl::Hidden, cl::init(true));
Kostya Serebryany1e575ab2012-08-15 08:58:58 +0000115static cl::opt<bool> ClAlwaysSlowPath("asan-always-slow-path",
116 cl::desc("use instrumentation with slow path for all accesses"),
117 cl::Hidden, cl::init(false));
Kostya Serebryany874dae62012-07-16 16:15:40 +0000118// This flag limits the number of instructions to be instrumented
Kostya Serebryanyc387ca72012-06-28 09:34:41 +0000119// in any given BB. Normally, this should be set to unlimited (INT_MAX),
120// but due to http://llvm.org/bugs/show_bug.cgi?id=12652 we temporary
121// set it to 10000.
122static cl::opt<int> ClMaxInsnsToInstrumentPerBB("asan-max-ins-per-bb",
123 cl::init(10000),
124 cl::desc("maximal number of instructions to instrument in any given BB"),
125 cl::Hidden);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000126// This flag may need to be replaced with -f[no]asan-stack.
127static cl::opt<bool> ClStack("asan-stack",
128 cl::desc("Handle stack memory"), cl::Hidden, cl::init(true));
129// This flag may need to be replaced with -f[no]asan-use-after-return.
130static cl::opt<bool> ClUseAfterReturn("asan-use-after-return",
131 cl::desc("Check return-after-free"), cl::Hidden, cl::init(false));
132// This flag may need to be replaced with -f[no]asan-globals.
133static cl::opt<bool> ClGlobals("asan-globals",
134 cl::desc("Handle global objects"), cl::Hidden, cl::init(true));
Kostya Serebryany714c67c2014-01-17 11:00:30 +0000135static cl::opt<int> ClCoverage("asan-coverage",
136 cl::desc("ASan coverage. 0: none, 1: entry block, 2: all blocks"),
137 cl::Hidden, cl::init(false));
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000138static cl::opt<bool> ClInitializers("asan-initialization-order",
139 cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000140static cl::opt<bool> ClMemIntrin("asan-memintrin",
141 cl::desc("Handle memset/memcpy/memmove"), cl::Hidden, cl::init(true));
Kostya Serebryany796f6552014-02-27 12:45:36 +0000142static cl::opt<bool> ClInvalidPointerPairs("asan-detect-invalid-pointer-pair",
143 cl::desc("Instrument <, <=, >, >=, - with pointer operands"),
Kostya Serebryanyec346652014-02-27 12:56:20 +0000144 cl::Hidden, cl::init(false));
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000145static cl::opt<unsigned> ClRealignStack("asan-realign-stack",
146 cl::desc("Realign stack to the value of this flag (power of two)"),
147 cl::Hidden, cl::init(32));
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000148static cl::opt<std::string> ClBlacklistFile("asan-blacklist",
149 cl::desc("File containing the list of objects to ignore "
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000150 "during instrumentation"), cl::Hidden);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000151
Kostya Serebryany9f5213f2013-06-26 09:18:17 +0000152// This is an experimental feature that will allow to choose between
153// instrumented and non-instrumented code at link-time.
154// If this option is on, just before instrumenting a function we create its
155// clone; if the function is not changed by asan the clone is deleted.
156// If we end up with a clone, we put the instrumented function into a section
157// called "ASAN" and the uninstrumented function into a section called "NOASAN".
158//
159// This is still a prototype, we need to figure out a way to keep two copies of
160// a function so that the linker can easily choose one of them.
161static cl::opt<bool> ClKeepUninstrumented("asan-keep-uninstrumented-functions",
162 cl::desc("Keep uninstrumented copies of functions"),
163 cl::Hidden, cl::init(false));
164
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000165// These flags allow to change the shadow mapping.
166// The shadow mapping looks like
167// Shadow = (Mem >> scale) + (1 << offset_log)
168static cl::opt<int> ClMappingScale("asan-mapping-scale",
169 cl::desc("scale of asan shadow mapping"), cl::Hidden, cl::init(0));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000170
171// Optimization flags. Not user visible, used mostly for testing
172// and benchmarking the tool.
173static cl::opt<bool> ClOpt("asan-opt",
174 cl::desc("Optimize instrumentation"), cl::Hidden, cl::init(true));
175static cl::opt<bool> ClOptSameTemp("asan-opt-same-temp",
176 cl::desc("Instrument the same temp just once"), cl::Hidden,
177 cl::init(true));
178static cl::opt<bool> ClOptGlobals("asan-opt-globals",
179 cl::desc("Don't instrument scalar globals"), cl::Hidden, cl::init(true));
180
Alexey Samsonovdf624522012-11-29 18:14:24 +0000181static cl::opt<bool> ClCheckLifetime("asan-check-lifetime",
182 cl::desc("Use llvm.lifetime intrinsics to insert extra checks"),
183 cl::Hidden, cl::init(false));
184
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000185// Debug flags.
186static cl::opt<int> ClDebug("asan-debug", cl::desc("debug"), cl::Hidden,
187 cl::init(0));
188static cl::opt<int> ClDebugStack("asan-debug-stack", cl::desc("debug stack"),
189 cl::Hidden, cl::init(0));
190static cl::opt<std::string> ClDebugFunc("asan-debug-func",
191 cl::Hidden, cl::desc("Debug func"));
192static cl::opt<int> ClDebugMin("asan-debug-min", cl::desc("Debug min inst"),
193 cl::Hidden, cl::init(-1));
194static cl::opt<int> ClDebugMax("asan-debug-max", cl::desc("Debug man inst"),
195 cl::Hidden, cl::init(-1));
196
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000197STATISTIC(NumInstrumentedReads, "Number of instrumented reads");
198STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
199STATISTIC(NumOptimizedAccessesToGlobalArray,
200 "Number of optimized accesses to global arrays");
201STATISTIC(NumOptimizedAccessesToGlobalVar,
202 "Number of optimized accesses to global vars");
203
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000204namespace {
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000205/// A set of dynamically initialized globals extracted from metadata.
206class SetOfDynamicallyInitializedGlobals {
207 public:
208 void Init(Module& M) {
209 // Clang generates metadata identifying all dynamically initialized globals.
210 NamedMDNode *DynamicGlobals =
211 M.getNamedMetadata("llvm.asan.dynamically_initialized_globals");
212 if (!DynamicGlobals)
213 return;
214 for (int i = 0, n = DynamicGlobals->getNumOperands(); i < n; ++i) {
215 MDNode *MDN = DynamicGlobals->getOperand(i);
216 assert(MDN->getNumOperands() == 1);
217 Value *VG = MDN->getOperand(0);
218 // The optimizer may optimize away a global entirely, in which case we
219 // cannot instrument access to it.
220 if (!VG)
221 continue;
222 DynInitGlobals.insert(cast<GlobalVariable>(VG));
223 }
224 }
225 bool Contains(GlobalVariable *G) { return DynInitGlobals.count(G) != 0; }
226 private:
227 SmallSet<GlobalValue*, 32> DynInitGlobals;
228};
229
Alexey Samsonov1345d352013-01-16 13:23:28 +0000230/// This struct defines the shadow mapping using the rule:
Kostya Serebryany4766fe62013-01-23 12:54:55 +0000231/// shadow = (mem >> Scale) ADD-or-OR Offset.
Alexey Samsonov1345d352013-01-16 13:23:28 +0000232struct ShadowMapping {
233 int Scale;
234 uint64_t Offset;
Kostya Serebryany4766fe62013-01-23 12:54:55 +0000235 bool OrShadowOffset;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000236};
237
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000238static ShadowMapping getShadowMapping(const Module &M, int LongSize) {
Alexey Samsonov347bcd32013-01-17 11:12:32 +0000239 llvm::Triple TargetTriple(M.getTargetTriple());
240 bool IsAndroid = TargetTriple.getEnvironment() == llvm::Triple::Android;
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000241 // bool IsMacOSX = TargetTriple.getOS() == llvm::Triple::MacOSX;
Kostya Serebryany8baa3862014-02-10 07:37:04 +0000242 bool IsFreeBSD = TargetTriple.getOS() == llvm::Triple::FreeBSD;
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000243 bool IsLinux = TargetTriple.getOS() == llvm::Triple::Linux;
Bill Schmidt0a9170d2013-07-26 01:35:43 +0000244 bool IsPPC64 = TargetTriple.getArch() == llvm::Triple::ppc64 ||
245 TargetTriple.getArch() == llvm::Triple::ppc64le;
Kostya Serebryanybe733372013-02-12 11:11:02 +0000246 bool IsX86_64 = TargetTriple.getArch() == llvm::Triple::x86_64;
Kostya Serebryany9e62b302013-06-03 14:46:56 +0000247 bool IsMIPS32 = TargetTriple.getArch() == llvm::Triple::mips ||
248 TargetTriple.getArch() == llvm::Triple::mipsel;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000249
250 ShadowMapping Mapping;
251
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000252 if (LongSize == 32) {
253 if (IsAndroid)
254 Mapping.Offset = 0;
255 else if (IsMIPS32)
256 Mapping.Offset = kMIPS32_ShadowOffset32;
257 else if (IsFreeBSD)
258 Mapping.Offset = kFreeBSD_ShadowOffset32;
259 else
260 Mapping.Offset = kDefaultShadowOffset32;
261 } else { // LongSize == 64
262 if (IsPPC64)
263 Mapping.Offset = kPPC64_ShadowOffset64;
264 else if (IsFreeBSD)
265 Mapping.Offset = kFreeBSD_ShadowOffset64;
266 else if (IsLinux && IsX86_64)
267 Mapping.Offset = kSmallX86_64ShadowOffset;
268 else
269 Mapping.Offset = kDefaultShadowOffset64;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000270 }
271
272 Mapping.Scale = kDefaultShadowScale;
273 if (ClMappingScale) {
274 Mapping.Scale = ClMappingScale;
275 }
276
Kostya Serebryanycc92c792014-02-24 13:40:24 +0000277 // OR-ing shadow offset if more efficient (at least on x86) if the offset
278 // is a power of two, but on ppc64 we have to use add since the shadow
279 // offset is not necessary 1/8-th of the address space.
280 Mapping.OrShadowOffset = !IsPPC64 && !(Mapping.Offset & (Mapping.Offset - 1));
281
Alexey Samsonov1345d352013-01-16 13:23:28 +0000282 return Mapping;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000283}
284
Alexey Samsonov1345d352013-01-16 13:23:28 +0000285static size_t RedzoneSizeForScale(int MappingScale) {
Kostya Serebryany20a79972012-11-22 03:18:50 +0000286 // Redzone used for stack and globals is at least 32 bytes.
287 // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
Alexey Samsonov1345d352013-01-16 13:23:28 +0000288 return std::max(32U, 1U << MappingScale);
Kostya Serebryany20a79972012-11-22 03:18:50 +0000289}
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000290
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000291/// AddressSanitizer: instrument the code in module to find memory bugs.
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000292struct AddressSanitizer : public FunctionPass {
Alexey Samsonov819eddc2013-03-14 12:38:58 +0000293 AddressSanitizer(bool CheckInitOrder = true,
Alexey Samsonovdf624522012-11-29 18:14:24 +0000294 bool CheckUseAfterReturn = false,
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000295 bool CheckLifetime = false,
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000296 StringRef BlacklistFile = StringRef())
Alexey Samsonovdf624522012-11-29 18:14:24 +0000297 : FunctionPass(ID),
298 CheckInitOrder(CheckInitOrder || ClInitializers),
299 CheckUseAfterReturn(CheckUseAfterReturn || ClUseAfterReturn),
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000300 CheckLifetime(CheckLifetime || ClCheckLifetime),
301 BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000302 : BlacklistFile) {}
Craig Topper3e4c6972014-03-05 09:10:37 +0000303 const char *getPassName() const override {
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000304 return "AddressSanitizerFunctionPass";
305 }
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000306 void instrumentMop(Instruction *I);
Kostya Serebryany796f6552014-02-27 12:45:36 +0000307 void instrumentPointerComparisonOrSubtraction(Instruction *I);
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000308 void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
309 Value *Addr, uint32_t TypeSize, bool IsWrite,
310 Value *SizeArgument);
Kostya Serebryany874dae62012-07-16 16:15:40 +0000311 Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
312 Value *ShadowValue, uint32_t TypeSize);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000313 Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000314 bool IsWrite, size_t AccessSizeIndex,
315 Value *SizeArgument);
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000316 bool instrumentMemIntrinsic(MemIntrinsic *MI);
317 void instrumentMemIntrinsicParam(Instruction *OrigIns, Value *Addr,
Kostya Serebryany874dae62012-07-16 16:15:40 +0000318 Value *Size,
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000319 Instruction *InsertBefore, bool IsWrite);
320 Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
Craig Topper3e4c6972014-03-05 09:10:37 +0000321 bool runOnFunction(Function &F) override;
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +0000322 bool maybeInsertAsanInitAtFunctionEntry(Function &F);
Craig Topper3e4c6972014-03-05 09:10:37 +0000323 bool doInitialization(Module &M) override;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000324 static char ID; // Pass identification, replacement for typeid
325
326 private:
Kostya Serebryany4b929da2012-11-29 09:54:21 +0000327 void initializeCallbacks(Module &M);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000328
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000329 bool ShouldInstrumentGlobal(GlobalVariable *G);
Kostya Serebryany1cdc6e92011-11-18 01:41:06 +0000330 bool LooksLikeCodeInBug11395(Instruction *I);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000331 void FindDynamicInitializers(Module &M);
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000332 bool GlobalIsLinkerInitialized(GlobalVariable *G);
Kostya Serebryany714c67c2014-01-17 11:00:30 +0000333 bool InjectCoverage(Function &F, const ArrayRef<BasicBlock*> AllBlocks);
334 void InjectCoverageAtBlock(Function &F, BasicBlock &BB);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000335
Alexey Samsonovdf624522012-11-29 18:14:24 +0000336 bool CheckInitOrder;
337 bool CheckUseAfterReturn;
338 bool CheckLifetime;
Alexey Samsonov347bcd32013-01-17 11:12:32 +0000339 SmallString<64> BlacklistFile;
Alexey Samsonov347bcd32013-01-17 11:12:32 +0000340
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000341 LLVMContext *C;
Rafael Espindolaaeff8a92014-02-24 23:12:18 +0000342 const DataLayout *DL;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000343 int LongSize;
344 Type *IntptrTy;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000345 ShadowMapping Mapping;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000346 Function *AsanCtorFunction;
347 Function *AsanInitFunction;
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000348 Function *AsanHandleNoReturnFunc;
Bob Wilsonda4147c2013-11-15 07:16:09 +0000349 Function *AsanCovFunction;
Kostya Serebryany796f6552014-02-27 12:45:36 +0000350 Function *AsanPtrCmpFunction, *AsanPtrSubFunction;
Ahmed Charles56440fd2014-03-06 05:51:42 +0000351 std::unique_ptr<SpecialCaseList> BL;
Kostya Serebryany4273bb02012-07-16 14:09:42 +0000352 // This array is indexed by AccessIsWrite and log2(AccessSize).
353 Function *AsanErrorCallback[2][kNumberOfAccessSizes];
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000354 // This array is indexed by AccessIsWrite.
355 Function *AsanErrorCallbackSized[2];
Kostya Serebryanyf02c6062012-07-20 09:54:50 +0000356 InlineAsm *EmptyAsm;
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +0000357 SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000358
359 friend struct FunctionStackPoisoner;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000360};
Kostya Serebryany874dae62012-07-16 16:15:40 +0000361
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000362class AddressSanitizerModule : public ModulePass {
Kostya Serebryany20a79972012-11-22 03:18:50 +0000363 public:
Alexey Samsonov819eddc2013-03-14 12:38:58 +0000364 AddressSanitizerModule(bool CheckInitOrder = true,
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000365 StringRef BlacklistFile = StringRef())
Alexey Samsonovdf624522012-11-29 18:14:24 +0000366 : ModulePass(ID),
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000367 CheckInitOrder(CheckInitOrder || ClInitializers),
368 BlacklistFile(BlacklistFile.empty() ? ClBlacklistFile
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000369 : BlacklistFile) {}
Craig Topper3e4c6972014-03-05 09:10:37 +0000370 bool runOnModule(Module &M) override;
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000371 static char ID; // Pass identification, replacement for typeid
Craig Topper3e4c6972014-03-05 09:10:37 +0000372 const char *getPassName() const override {
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000373 return "AddressSanitizerModule";
374 }
Alexey Samsonov261177a2012-12-04 01:34:23 +0000375
Kostya Serebryany20a79972012-11-22 03:18:50 +0000376 private:
Alexey Samsonov788381b2012-12-25 12:28:20 +0000377 void initializeCallbacks(Module &M);
378
Kostya Serebryany20a79972012-11-22 03:18:50 +0000379 bool ShouldInstrumentGlobal(GlobalVariable *G);
Alexey Samsonove1e26bf2013-03-26 13:05:41 +0000380 void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000381 size_t MinRedzoneSizeForGlobal() const {
Alexey Samsonov1345d352013-01-16 13:23:28 +0000382 return RedzoneSizeForScale(Mapping.Scale);
383 }
Kostya Serebryany20a79972012-11-22 03:18:50 +0000384
Alexey Samsonovdf624522012-11-29 18:14:24 +0000385 bool CheckInitOrder;
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000386 SmallString<64> BlacklistFile;
Alexey Samsonov347bcd32013-01-17 11:12:32 +0000387
Ahmed Charles56440fd2014-03-06 05:51:42 +0000388 std::unique_ptr<SpecialCaseList> BL;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000389 SetOfDynamicallyInitializedGlobals DynamicallyInitializedGlobals;
390 Type *IntptrTy;
391 LLVMContext *C;
Rafael Espindolaaeff8a92014-02-24 23:12:18 +0000392 const DataLayout *DL;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000393 ShadowMapping Mapping;
Alexey Samsonov788381b2012-12-25 12:28:20 +0000394 Function *AsanPoisonGlobals;
395 Function *AsanUnpoisonGlobals;
396 Function *AsanRegisterGlobals;
397 Function *AsanUnregisterGlobals;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000398};
399
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000400// Stack poisoning does not play well with exception handling.
401// When an exception is thrown, we essentially bypass the code
402// that unpoisones the stack. This is why the run-time library has
403// to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
404// stack in the interceptor. This however does not work inside the
405// actual function which catches the exception. Most likely because the
406// compiler hoists the load of the shadow value somewhere too high.
407// This causes asan to report a non-existing bug on 453.povray.
408// It sounds like an LLVM bug.
409struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
410 Function &F;
411 AddressSanitizer &ASan;
412 DIBuilder DIB;
413 LLVMContext *C;
414 Type *IntptrTy;
415 Type *IntptrPtrTy;
Alexey Samsonov1345d352013-01-16 13:23:28 +0000416 ShadowMapping Mapping;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000417
418 SmallVector<AllocaInst*, 16> AllocaVec;
419 SmallVector<Instruction*, 8> RetVec;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000420 unsigned StackAlignment;
421
Kostya Serebryany6805de52013-09-10 13:16:56 +0000422 Function *AsanStackMallocFunc[kMaxAsanStackMallocSizeClass + 1],
423 *AsanStackFreeFunc[kMaxAsanStackMallocSizeClass + 1];
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000424 Function *AsanPoisonStackMemoryFunc, *AsanUnpoisonStackMemoryFunc;
425
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000426 // Stores a place and arguments of poisoning/unpoisoning call for alloca.
427 struct AllocaPoisonCall {
428 IntrinsicInst *InsBefore;
Alexey Samsonova788b942013-11-18 14:53:55 +0000429 AllocaInst *AI;
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000430 uint64_t Size;
431 bool DoPoison;
432 };
433 SmallVector<AllocaPoisonCall, 8> AllocaPoisonCallVec;
434
435 // Maps Value to an AllocaInst from which the Value is originated.
436 typedef DenseMap<Value*, AllocaInst*> AllocaForValueMapTy;
437 AllocaForValueMapTy AllocaForValue;
438
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000439 FunctionStackPoisoner(Function &F, AddressSanitizer &ASan)
440 : F(F), ASan(ASan), DIB(*F.getParent()), C(ASan.C),
441 IntptrTy(ASan.IntptrTy), IntptrPtrTy(PointerType::get(IntptrTy, 0)),
Alexey Samsonov1345d352013-01-16 13:23:28 +0000442 Mapping(ASan.Mapping),
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000443 StackAlignment(1 << Mapping.Scale) {}
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000444
445 bool runOnFunction() {
446 if (!ClStack) return false;
447 // Collect alloca, ret, lifetime instructions etc.
448 for (df_iterator<BasicBlock*> DI = df_begin(&F.getEntryBlock()),
449 DE = df_end(&F.getEntryBlock()); DI != DE; ++DI) {
450 BasicBlock *BB = *DI;
451 visit(*BB);
452 }
453 if (AllocaVec.empty()) return false;
454
455 initializeCallbacks(*F.getParent());
456
457 poisonStack();
458
459 if (ClDebugStack) {
460 DEBUG(dbgs() << F);
461 }
462 return true;
463 }
464
465 // Finds all static Alloca instructions and puts
466 // poisoned red zones around all of them.
467 // Then unpoison everything back before the function returns.
468 void poisonStack();
469
470 // ----------------------- Visitors.
471 /// \brief Collect all Ret instructions.
472 void visitReturnInst(ReturnInst &RI) {
473 RetVec.push_back(&RI);
474 }
475
476 /// \brief Collect Alloca instructions we want (and can) handle.
477 void visitAllocaInst(AllocaInst &AI) {
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000478 if (!isInterestingAlloca(AI)) return;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000479
480 StackAlignment = std::max(StackAlignment, AI.getAlignment());
481 AllocaVec.push_back(&AI);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000482 }
483
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000484 /// \brief Collect lifetime intrinsic calls to check for use-after-scope
485 /// errors.
486 void visitIntrinsicInst(IntrinsicInst &II) {
487 if (!ASan.CheckLifetime) return;
488 Intrinsic::ID ID = II.getIntrinsicID();
489 if (ID != Intrinsic::lifetime_start &&
490 ID != Intrinsic::lifetime_end)
491 return;
492 // Found lifetime intrinsic, add ASan instrumentation if necessary.
493 ConstantInt *Size = dyn_cast<ConstantInt>(II.getArgOperand(0));
494 // If size argument is undefined, don't do anything.
495 if (Size->isMinusOne()) return;
496 // Check that size doesn't saturate uint64_t and can
497 // be stored in IntptrTy.
498 const uint64_t SizeValue = Size->getValue().getLimitedValue();
499 if (SizeValue == ~0ULL ||
500 !ConstantInt::isValueValidForType(IntptrTy, SizeValue))
501 return;
502 // Find alloca instruction that corresponds to llvm.lifetime argument.
503 AllocaInst *AI = findAllocaForValue(II.getArgOperand(1));
504 if (!AI) return;
505 bool DoPoison = (ID == Intrinsic::lifetime_end);
Alexey Samsonova788b942013-11-18 14:53:55 +0000506 AllocaPoisonCall APC = {&II, AI, SizeValue, DoPoison};
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000507 AllocaPoisonCallVec.push_back(APC);
508 }
509
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000510 // ---------------------- Helpers.
511 void initializeCallbacks(Module &M);
512
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000513 // Check if we want (and can) handle this alloca.
Jakub Staszak23ec6a92013-08-09 20:53:48 +0000514 bool isInterestingAlloca(AllocaInst &AI) const {
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000515 return (!AI.isArrayAllocation() && AI.isStaticAlloca() &&
516 AI.getAllocatedType()->isSized() &&
517 // alloca() may be called with 0 size, ignore it.
518 getAllocaSizeInBytes(&AI) > 0);
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000519 }
520
Jakub Staszak23ec6a92013-08-09 20:53:48 +0000521 uint64_t getAllocaSizeInBytes(AllocaInst *AI) const {
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000522 Type *Ty = AI->getAllocatedType();
Rafael Espindola37dc9e12014-02-21 00:06:31 +0000523 uint64_t SizeInBytes = ASan.DL->getTypeAllocSize(Ty);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000524 return SizeInBytes;
525 }
Alexey Samsonov29dd7f22012-12-27 08:50:58 +0000526 /// Finds alloca where the value comes from.
527 AllocaInst *findAllocaForValue(Value *V);
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000528 void poisonRedZones(const ArrayRef<uint8_t> ShadowBytes, IRBuilder<> &IRB,
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000529 Value *ShadowBase, bool DoPoison);
Jakub Staszak23ec6a92013-08-09 20:53:48 +0000530 void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +0000531
532 void SetShadowToStackAfterReturnInlined(IRBuilder<> &IRB, Value *ShadowBase,
533 int Size);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +0000534};
535
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000536} // namespace
537
538char AddressSanitizer::ID = 0;
539INITIALIZE_PASS(AddressSanitizer, "asan",
540 "AddressSanitizer: detects use-after-free and out-of-bounds bugs.",
541 false, false)
Alexey Samsonovdf624522012-11-29 18:14:24 +0000542FunctionPass *llvm::createAddressSanitizerFunctionPass(
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000543 bool CheckInitOrder, bool CheckUseAfterReturn, bool CheckLifetime,
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000544 StringRef BlacklistFile) {
Alexey Samsonovdf624522012-11-29 18:14:24 +0000545 return new AddressSanitizer(CheckInitOrder, CheckUseAfterReturn,
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000546 CheckLifetime, BlacklistFile);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000547}
548
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000549char AddressSanitizerModule::ID = 0;
550INITIALIZE_PASS(AddressSanitizerModule, "asan-module",
551 "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
552 "ModulePass", false, false)
Alexey Samsonovef51c3f2012-12-03 19:09:26 +0000553ModulePass *llvm::createAddressSanitizerModulePass(
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000554 bool CheckInitOrder, StringRef BlacklistFile) {
555 return new AddressSanitizerModule(CheckInitOrder, BlacklistFile);
Alexander Potapenkoc94cf8f2012-01-23 11:22:43 +0000556}
557
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +0000558static size_t TypeSizeToSizeIndex(uint32_t TypeSize) {
Michael J. Spencerdf1ecbd72013-05-24 22:23:49 +0000559 size_t Res = countTrailingZeros(TypeSize / 8);
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +0000560 assert(Res < kNumberOfAccessSizes);
561 return Res;
562}
563
Bill Wendling58f8cef2013-08-06 22:52:42 +0000564// \brief Create a constant for Str so that we can pass it to the run-time lib.
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +0000565static GlobalVariable *createPrivateGlobalForString(
566 Module &M, StringRef Str, bool AllowMerging) {
Chris Lattnercf9e8f62012-02-05 02:29:43 +0000567 Constant *StrConst = ConstantDataArray::getString(M.getContext(), Str);
Rafael Espindoladaeafb42014-02-19 17:23:20 +0000568 // We use private linkage for module-local strings. If they can be merged
569 // with another one, we set the unnamed_addr attribute.
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +0000570 GlobalVariable *GV =
571 new GlobalVariable(M, StrConst->getType(), true,
Rafael Espindoladaeafb42014-02-19 17:23:20 +0000572 GlobalValue::PrivateLinkage, StrConst, kAsanGenPrefix);
573 if (AllowMerging)
574 GV->setUnnamedAddr(true);
Kostya Serebryany10cc12f2013-03-18 09:38:39 +0000575 GV->setAlignment(1); // Strings may not be merged w/o setting align 1.
576 return GV;
Kostya Serebryany139a9372012-11-20 14:16:08 +0000577}
578
579static bool GlobalWasGeneratedByAsan(GlobalVariable *G) {
580 return G->getName().find(kAsanGenPrefix) == 0;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000581}
582
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000583Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
584 // Shadow >> scale
Alexey Samsonov1345d352013-01-16 13:23:28 +0000585 Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
586 if (Mapping.Offset == 0)
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000587 return Shadow;
588 // (Shadow >> scale) | offset
Kostya Serebryany4766fe62013-01-23 12:54:55 +0000589 if (Mapping.OrShadowOffset)
590 return IRB.CreateOr(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset));
591 else
592 return IRB.CreateAdd(Shadow, ConstantInt::get(IntptrTy, Mapping.Offset));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000593}
594
Kostya Serebryany874dae62012-07-16 16:15:40 +0000595void AddressSanitizer::instrumentMemIntrinsicParam(
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000596 Instruction *OrigIns,
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000597 Value *Addr, Value *Size, Instruction *InsertBefore, bool IsWrite) {
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000598 IRBuilder<> IRB(InsertBefore);
599 if (Size->getType() != IntptrTy)
600 Size = IRB.CreateIntCast(Size, IntptrTy, false);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000601 // Check the first byte.
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000602 instrumentAddress(OrigIns, InsertBefore, Addr, 8, IsWrite, Size);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000603 // Check the last byte.
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000604 IRB.SetInsertPoint(InsertBefore);
605 Value *SizeMinusOne = IRB.CreateSub(Size, ConstantInt::get(IntptrTy, 1));
606 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
607 Value *AddrLast = IRB.CreateAdd(AddrLong, SizeMinusOne);
608 instrumentAddress(OrigIns, InsertBefore, AddrLast, 8, IsWrite, Size);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000609}
610
611// Instrument memset/memmove/memcpy
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000612bool AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000613 Value *Dst = MI->getDest();
614 MemTransferInst *MemTran = dyn_cast<MemTransferInst>(MI);
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +0000615 Value *Src = MemTran ? MemTran->getSource() : 0;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000616 Value *Length = MI->getLength();
617
618 Constant *ConstLength = dyn_cast<Constant>(Length);
619 Instruction *InsertBefore = MI;
620 if (ConstLength) {
621 if (ConstLength->isNullValue()) return false;
622 } else {
623 // The size is not a constant so it could be zero -- check at run-time.
624 IRBuilder<> IRB(InsertBefore);
625
626 Value *Cmp = IRB.CreateICmpNE(Length,
Kostya Serebryanyeeaf6882012-07-02 11:42:29 +0000627 Constant::getNullValue(Length->getType()));
Evgeniy Stepanova9164e92013-12-19 13:29:56 +0000628 InsertBefore = SplitBlockAndInsertIfThen(Cmp, InsertBefore, false);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000629 }
630
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000631 instrumentMemIntrinsicParam(MI, Dst, Length, InsertBefore, true);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000632 if (Src)
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000633 instrumentMemIntrinsicParam(MI, Src, Length, InsertBefore, false);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000634 return true;
635}
636
Kostya Serebryany90241602012-05-30 09:04:06 +0000637// If I is an interesting memory access, return the PointerOperand
638// and set IsWrite. Otherwise return NULL.
639static Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000640 if (LoadInst *LI = dyn_cast<LoadInst>(I)) {
Kostya Serebryany90241602012-05-30 09:04:06 +0000641 if (!ClInstrumentReads) return NULL;
642 *IsWrite = false;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000643 return LI->getPointerOperand();
644 }
Kostya Serebryany90241602012-05-30 09:04:06 +0000645 if (StoreInst *SI = dyn_cast<StoreInst>(I)) {
646 if (!ClInstrumentWrites) return NULL;
647 *IsWrite = true;
648 return SI->getPointerOperand();
649 }
650 if (AtomicRMWInst *RMW = dyn_cast<AtomicRMWInst>(I)) {
651 if (!ClInstrumentAtomics) return NULL;
652 *IsWrite = true;
653 return RMW->getPointerOperand();
654 }
655 if (AtomicCmpXchgInst *XCHG = dyn_cast<AtomicCmpXchgInst>(I)) {
656 if (!ClInstrumentAtomics) return NULL;
657 *IsWrite = true;
658 return XCHG->getPointerOperand();
659 }
660 return NULL;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000661}
662
Kostya Serebryany796f6552014-02-27 12:45:36 +0000663static bool isPointerOperand(Value *V) {
664 return V->getType()->isPointerTy() || isa<PtrToIntInst>(V);
665}
666
667// This is a rough heuristic; it may cause both false positives and
668// false negatives. The proper implementation requires cooperation with
669// the frontend.
670static bool isInterestingPointerComparisonOrSubtraction(Instruction *I) {
671 if (ICmpInst *Cmp = dyn_cast<ICmpInst>(I)) {
672 if (!Cmp->isRelational())
673 return false;
674 } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
Kostya Serebryanycb3f6e12014-02-27 13:13:59 +0000675 if (BO->getOpcode() != Instruction::Sub)
Kostya Serebryany796f6552014-02-27 12:45:36 +0000676 return false;
677 } else {
678 return false;
679 }
680 if (!isPointerOperand(I->getOperand(0)) ||
681 !isPointerOperand(I->getOperand(1)))
682 return false;
683 return true;
684}
685
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000686bool AddressSanitizer::GlobalIsLinkerInitialized(GlobalVariable *G) {
687 // If a global variable does not have dynamic initialization we don't
688 // have to instrument it. However, if a global does not have initializer
689 // at all, we assume it has dynamic initializer (in other TU).
690 return G->hasInitializer() && !DynamicallyInitializedGlobals.Contains(G);
691}
692
Kostya Serebryany796f6552014-02-27 12:45:36 +0000693void
694AddressSanitizer::instrumentPointerComparisonOrSubtraction(Instruction *I) {
695 IRBuilder<> IRB(I);
696 Function *F = isa<ICmpInst>(I) ? AsanPtrCmpFunction : AsanPtrSubFunction;
697 Value *Param[2] = {I->getOperand(0), I->getOperand(1)};
698 for (int i = 0; i < 2; i++) {
699 if (Param[i]->getType()->isPointerTy())
700 Param[i] = IRB.CreatePointerCast(Param[i], IntptrTy);
701 }
702 IRB.CreateCall2(F, Param[0], Param[1]);
703}
704
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000705void AddressSanitizer::instrumentMop(Instruction *I) {
Axel Naumann4a127062012-09-17 14:20:57 +0000706 bool IsWrite = false;
Kostya Serebryany90241602012-05-30 09:04:06 +0000707 Value *Addr = isInterestingMemoryAccess(I, &IsWrite);
708 assert(Addr);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000709 if (ClOpt && ClOptGlobals) {
710 if (GlobalVariable *G = dyn_cast<GlobalVariable>(Addr)) {
711 // If initialization order checking is disabled, a simple access to a
712 // dynamically initialized global is always valid.
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000713 if (!CheckInitOrder || GlobalIsLinkerInitialized(G)) {
714 NumOptimizedAccessesToGlobalVar++;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000715 return;
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000716 }
717 }
718 ConstantExpr *CE = dyn_cast<ConstantExpr>(Addr);
719 if (CE && CE->isGEPWithNoNotionalOverIndexing()) {
720 if (GlobalVariable *G = dyn_cast<GlobalVariable>(CE->getOperand(0))) {
721 if (CE->getOperand(1)->isNullValue() && GlobalIsLinkerInitialized(G)) {
722 NumOptimizedAccessesToGlobalArray++;
723 return;
724 }
725 }
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000726 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000727 }
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000728
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000729 Type *OrigPtrTy = Addr->getType();
730 Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType();
731
732 assert(OrigTy->isSized());
Rafael Espindola37dc9e12014-02-21 00:06:31 +0000733 uint32_t TypeSize = DL->getTypeStoreSizeInBits(OrigTy);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000734
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000735 assert((TypeSize % 8) == 0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000736
Kostya Serebryanyd3d23be2013-10-16 14:06:14 +0000737 if (IsWrite)
738 NumInstrumentedWrites++;
739 else
740 NumInstrumentedReads++;
741
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000742 // Instrument a 1-, 2-, 4-, 8-, or 16- byte access with one check.
743 if (TypeSize == 8 || TypeSize == 16 ||
744 TypeSize == 32 || TypeSize == 64 || TypeSize == 128)
745 return instrumentAddress(I, I, Addr, TypeSize, IsWrite, 0);
746 // Instrument unusual size (but still multiple of 8).
747 // We can not do it with a single check, so we do 1-byte check for the first
748 // and the last bytes. We call __asan_report_*_n(addr, real_size) to be able
749 // to report the actual access size.
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000750 IRBuilder<> IRB(I);
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000751 Value *LastByte = IRB.CreateIntToPtr(
752 IRB.CreateAdd(IRB.CreatePointerCast(Addr, IntptrTy),
753 ConstantInt::get(IntptrTy, TypeSize / 8 - 1)),
754 OrigPtrTy);
755 Value *Size = ConstantInt::get(IntptrTy, TypeSize / 8);
756 instrumentAddress(I, I, Addr, 8, IsWrite, Size);
757 instrumentAddress(I, I, LastByte, 8, IsWrite, Size);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000758}
759
Alexander Potapenko056e27e2012-04-23 10:47:31 +0000760// Validate the result of Module::getOrInsertFunction called for an interface
761// function of AddressSanitizer. If the instrumented module defines a function
762// with the same name, their prototypes must match, otherwise
763// getOrInsertFunction returns a bitcast.
Kostya Serebryany20a79972012-11-22 03:18:50 +0000764static Function *checkInterfaceFunction(Constant *FuncOrBitcast) {
Alexander Potapenko056e27e2012-04-23 10:47:31 +0000765 if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast);
766 FuncOrBitcast->dump();
767 report_fatal_error("trying to redefine an AddressSanitizer "
768 "interface function");
769}
770
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000771Instruction *AddressSanitizer::generateCrashCode(
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000772 Instruction *InsertBefore, Value *Addr,
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000773 bool IsWrite, size_t AccessSizeIndex, Value *SizeArgument) {
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000774 IRBuilder<> IRB(InsertBefore);
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000775 CallInst *Call = SizeArgument
776 ? IRB.CreateCall2(AsanErrorCallbackSized[IsWrite], Addr, SizeArgument)
777 : IRB.CreateCall(AsanErrorCallback[IsWrite][AccessSizeIndex], Addr);
778
Kostya Serebryanyf02c6062012-07-20 09:54:50 +0000779 // We don't do Call->setDoesNotReturn() because the BB already has
780 // UnreachableInst at the end.
781 // This EmptyAsm is required to avoid callback merge.
782 IRB.CreateCall(EmptyAsm);
Kostya Serebryany3411f2e2012-01-06 18:09:21 +0000783 return Call;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000784}
785
Kostya Serebryanyc4ce5df2012-07-16 17:12:07 +0000786Value *AddressSanitizer::createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
Kostya Serebryany874dae62012-07-16 16:15:40 +0000787 Value *ShadowValue,
788 uint32_t TypeSize) {
Alexey Samsonov1345d352013-01-16 13:23:28 +0000789 size_t Granularity = 1 << Mapping.Scale;
Kostya Serebryany874dae62012-07-16 16:15:40 +0000790 // Addr & (Granularity - 1)
791 Value *LastAccessedByte = IRB.CreateAnd(
792 AddrLong, ConstantInt::get(IntptrTy, Granularity - 1));
793 // (Addr & (Granularity - 1)) + size - 1
794 if (TypeSize / 8 > 1)
795 LastAccessedByte = IRB.CreateAdd(
796 LastAccessedByte, ConstantInt::get(IntptrTy, TypeSize / 8 - 1));
797 // (uint8_t) ((Addr & (Granularity-1)) + size - 1)
798 LastAccessedByte = IRB.CreateIntCast(
Kostya Serebryany1e575ab2012-08-15 08:58:58 +0000799 LastAccessedByte, ShadowValue->getType(), false);
Kostya Serebryany874dae62012-07-16 16:15:40 +0000800 // ((uint8_t) ((Addr & (Granularity-1)) + size - 1)) >= ShadowValue
801 return IRB.CreateICmpSGE(LastAccessedByte, ShadowValue);
802}
803
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000804void AddressSanitizer::instrumentAddress(Instruction *OrigIns,
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000805 Instruction *InsertBefore,
806 Value *Addr, uint32_t TypeSize,
807 bool IsWrite, Value *SizeArgument) {
808 IRBuilder<> IRB(InsertBefore);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000809 Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
810
811 Type *ShadowTy = IntegerType::get(
Alexey Samsonov1345d352013-01-16 13:23:28 +0000812 *C, std::max(8U, TypeSize >> Mapping.Scale));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000813 Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
814 Value *ShadowPtr = memToShadow(AddrLong, IRB);
815 Value *CmpVal = Constant::getNullValue(ShadowTy);
816 Value *ShadowValue = IRB.CreateLoad(
817 IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy));
818
819 Value *Cmp = IRB.CreateICmpNE(ShadowValue, CmpVal);
Kostya Serebryany0f7a80d2012-08-13 14:08:46 +0000820 size_t AccessSizeIndex = TypeSizeToSizeIndex(TypeSize);
Alexey Samsonov1345d352013-01-16 13:23:28 +0000821 size_t Granularity = 1 << Mapping.Scale;
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000822 TerminatorInst *CrashTerm = 0;
823
Kostya Serebryany1e575ab2012-08-15 08:58:58 +0000824 if (ClAlwaysSlowPath || (TypeSize < 8 * Granularity)) {
Evgeniy Stepanov8eb77d82012-10-19 10:48:31 +0000825 TerminatorInst *CheckTerm =
Evgeniy Stepanova9164e92013-12-19 13:29:56 +0000826 SplitBlockAndInsertIfThen(Cmp, InsertBefore, false);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000827 assert(dyn_cast<BranchInst>(CheckTerm)->isUnconditional());
Kostya Serebryanyf02c6062012-07-20 09:54:50 +0000828 BasicBlock *NextBB = CheckTerm->getSuccessor(0);
Kostya Serebryany874dae62012-07-16 16:15:40 +0000829 IRB.SetInsertPoint(CheckTerm);
830 Value *Cmp2 = createSlowPathCmp(IRB, AddrLong, ShadowValue, TypeSize);
Kostya Serebryanyb0e25062012-10-15 14:20:06 +0000831 BasicBlock *CrashBlock =
832 BasicBlock::Create(*C, "", NextBB->getParent(), NextBB);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000833 CrashTerm = new UnreachableInst(*C, CrashBlock);
Kostya Serebryanyf02c6062012-07-20 09:54:50 +0000834 BranchInst *NewTerm = BranchInst::Create(CrashBlock, NextBB, Cmp2);
835 ReplaceInstWithInst(CheckTerm, NewTerm);
Kostya Serebryany874dae62012-07-16 16:15:40 +0000836 } else {
Evgeniy Stepanova9164e92013-12-19 13:29:56 +0000837 CrashTerm = SplitBlockAndInsertIfThen(Cmp, InsertBefore, true);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000838 }
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000839
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +0000840 Instruction *Crash = generateCrashCode(
841 CrashTerm, AddrLong, IsWrite, AccessSizeIndex, SizeArgument);
Kostya Serebryanyfda7a132012-08-14 14:04:51 +0000842 Crash->setDebugLoc(OrigIns->getDebugLoc());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000843}
844
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000845void AddressSanitizerModule::createInitializerPoisonCalls(
Alexey Samsonove1e26bf2013-03-26 13:05:41 +0000846 Module &M, GlobalValue *ModuleName) {
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000847 // We do all of our poisoning and unpoisoning within _GLOBAL__I_a.
848 Function *GlobalInit = M.getFunction("_GLOBAL__I_a");
849 // If that function is not present, this TU contains no globals, or they have
850 // all been optimized away
851 if (!GlobalInit)
852 return;
853
854 // Set up the arguments to our poison/unpoison functions.
855 IRBuilder<> IRB(GlobalInit->begin()->getFirstInsertionPt());
856
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000857 // Add a call to poison all external globals before the given function starts.
Alexey Samsonove1e26bf2013-03-26 13:05:41 +0000858 Value *ModuleNameAddr = ConstantExpr::getPointerCast(ModuleName, IntptrTy);
859 IRB.CreateCall(AsanPoisonGlobals, ModuleNameAddr);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000860
861 // Add calls to unpoison all globals before each return instruction.
862 for (Function::iterator I = GlobalInit->begin(), E = GlobalInit->end();
863 I != E; ++I) {
864 if (ReturnInst *RI = dyn_cast<ReturnInst>(I->getTerminator())) {
865 CallInst::Create(AsanUnpoisonGlobals, "", RI);
866 }
867 }
868}
869
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000870bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) {
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000871 Type *Ty = cast<PointerType>(G->getType())->getElementType();
Kostya Serebryany20343352012-10-17 13:40:06 +0000872 DEBUG(dbgs() << "GLOBAL: " << *G << "\n");
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000873
Kostya Serebryany2fa38f82012-09-05 07:29:56 +0000874 if (BL->isIn(*G)) return false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000875 if (!Ty->isSized()) return false;
876 if (!G->hasInitializer()) return false;
Kostya Serebryany139a9372012-11-20 14:16:08 +0000877 if (GlobalWasGeneratedByAsan(G)) return false; // Our own global.
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000878 // Touch only those globals that will not be defined in other modules.
879 // Don't handle ODR type linkages since other modules may be built w/o asan.
880 if (G->getLinkage() != GlobalVariable::ExternalLinkage &&
881 G->getLinkage() != GlobalVariable::PrivateLinkage &&
882 G->getLinkage() != GlobalVariable::InternalLinkage)
883 return false;
884 // Two problems with thread-locals:
885 // - The address of the main thread's copy can't be computed at link-time.
886 // - Need to poison all copies, not just the main thread's one.
887 if (G->isThreadLocal())
888 return false;
Kostya Serebryany4fb78012013-12-06 09:00:17 +0000889 // For now, just ignore this Global if the alignment is large.
890 if (G->getAlignment() > MinRedzoneSizeForGlobal()) return false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000891
892 // Ignore all the globals with the names starting with "\01L_OBJC_".
893 // Many of those are put into the .cstring section. The linker compresses
894 // that section by removing the spare \0s after the string terminator, so
895 // our redzones get broken.
896 if ((G->getName().find("\01L_OBJC_") == 0) ||
897 (G->getName().find("\01l_OBJC_") == 0)) {
Alexander Potapenkob76ea322014-03-14 10:41:49 +0000898 DEBUG(dbgs() << "Ignoring \\01L_OBJC_* global: " << *G << "\n");
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000899 return false;
900 }
901
902 if (G->hasSection()) {
903 StringRef Section(G->getSection());
904 // Ignore the globals from the __OBJC section. The ObjC runtime assumes
905 // those conform to /usr/lib/objc/runtime.h, so we can't add redzones to
906 // them.
907 if ((Section.find("__OBJC,") == 0) ||
908 (Section.find("__DATA, __objc_") == 0)) {
Alexander Potapenkob76ea322014-03-14 10:41:49 +0000909 DEBUG(dbgs() << "Ignoring ObjC runtime global: " << *G << "\n");
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000910 return false;
911 }
912 // See http://code.google.com/p/address-sanitizer/issues/detail?id=32
913 // Constant CFString instances are compiled in the following way:
914 // -- the string buffer is emitted into
915 // __TEXT,__cstring,cstring_literals
916 // -- the constant NSConstantString structure referencing that buffer
917 // is placed into __DATA,__cfstring
918 // Therefore there's no point in placing redzones into __DATA,__cfstring.
919 // Moreover, it causes the linker to crash on OS X 10.7
920 if (Section.find("__DATA,__cfstring") == 0) {
Alexander Potapenkob76ea322014-03-14 10:41:49 +0000921 DEBUG(dbgs() << "Ignoring CFString: " << *G << "\n");
922 return false;
923 }
924 // The linker merges the contents of cstring_literals and removes the
925 // trailing zeroes.
926 if (Section.find("__TEXT,__cstring,cstring_literals") == 0) {
927 DEBUG(dbgs() << "Ignoring a cstring literal: " << *G << "\n");
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000928 return false;
929 }
930 }
931
932 return true;
933}
934
Alexey Samsonov788381b2012-12-25 12:28:20 +0000935void AddressSanitizerModule::initializeCallbacks(Module &M) {
936 IRBuilder<> IRB(*C);
937 // Declare our poisoning and unpoisoning functions.
938 AsanPoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction(
Alexey Samsonove1e26bf2013-03-26 13:05:41 +0000939 kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, NULL));
Alexey Samsonov788381b2012-12-25 12:28:20 +0000940 AsanPoisonGlobals->setLinkage(Function::ExternalLinkage);
941 AsanUnpoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction(
942 kAsanUnpoisonGlobalsName, IRB.getVoidTy(), NULL));
943 AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage);
944 // Declare functions that register/unregister globals.
945 AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction(
946 kAsanRegisterGlobalsName, IRB.getVoidTy(),
947 IntptrTy, IntptrTy, NULL));
948 AsanRegisterGlobals->setLinkage(Function::ExternalLinkage);
949 AsanUnregisterGlobals = checkInterfaceFunction(M.getOrInsertFunction(
950 kAsanUnregisterGlobalsName,
951 IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
952 AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage);
953}
954
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000955// This function replaces all global variables with new variables that have
956// trailing redzones. It also creates a function that poisons
957// redzones and inserts this function into llvm.global_ctors.
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000958bool AddressSanitizerModule::runOnModule(Module &M) {
959 if (!ClGlobals) return false;
Rafael Espindola93512512014-02-25 17:30:31 +0000960
961 DataLayoutPass *DLP = getAnalysisIfAvailable<DataLayoutPass>();
962 if (!DLP)
Kostya Serebryanydfe9e792012-11-28 10:31:36 +0000963 return false;
Rafael Espindola93512512014-02-25 17:30:31 +0000964 DL = &DLP->getDataLayout();
965
Alexey Samsonove4b5fb82013-08-12 11:46:09 +0000966 BL.reset(SpecialCaseList::createOrDie(BlacklistFile));
Alexey Samsonov9a956e82012-11-29 18:27:01 +0000967 if (BL->isIn(M)) return false;
Kostya Serebryany20a79972012-11-22 03:18:50 +0000968 C = &(M.getContext());
Rafael Espindola37dc9e12014-02-21 00:06:31 +0000969 int LongSize = DL->getPointerSizeInBits();
Alexey Samsonov1345d352013-01-16 13:23:28 +0000970 IntptrTy = Type::getIntNTy(*C, LongSize);
Evgeniy Stepanov13665362014-01-16 10:19:12 +0000971 Mapping = getShadowMapping(M, LongSize);
Alexey Samsonov788381b2012-12-25 12:28:20 +0000972 initializeCallbacks(M);
973 DynamicallyInitializedGlobals.Init(M);
Kostya Serebryany20a79972012-11-22 03:18:50 +0000974
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000975 SmallVector<GlobalVariable *, 16> GlobalsToChange;
976
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000977 for (Module::GlobalListType::iterator G = M.global_begin(),
978 E = M.global_end(); G != E; ++G) {
979 if (ShouldInstrumentGlobal(G))
980 GlobalsToChange.push_back(G);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000981 }
982
983 size_t n = GlobalsToChange.size();
984 if (n == 0) return false;
985
986 // A global is described by a structure
987 // size_t beg;
988 // size_t size;
989 // size_t size_with_redzone;
990 // const char *name;
Kostya Serebryanybd016bb2013-03-18 08:05:29 +0000991 // const char *module_name;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000992 // size_t has_dynamic_init;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +0000993 // We initialize an array of such structures and pass it to a run-time call.
994 StructType *GlobalStructTy = StructType::get(IntptrTy, IntptrTy,
Kostya Serebryanyf4be0192012-08-21 08:24:25 +0000995 IntptrTy, IntptrTy,
Kostya Serebryanybd016bb2013-03-18 08:05:29 +0000996 IntptrTy, IntptrTy, NULL);
Rafael Espindola44fee4e2013-10-01 13:32:03 +0000997 SmallVector<Constant *, 16> Initializers(n);
Kostya Serebryany20a79972012-11-22 03:18:50 +0000998
999 Function *CtorFunc = M.getFunction(kAsanModuleCtorName);
1000 assert(CtorFunc);
1001 IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001002
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00001003 bool HasDynamicallyInitializedGlobals = false;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001004
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00001005 // We shouldn't merge same module names, as this string serves as unique
1006 // module ID in runtime.
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +00001007 GlobalVariable *ModuleName = createPrivateGlobalForString(
1008 M, M.getModuleIdentifier(), /*AllowMerging*/false);
Kostya Serebryanybd016bb2013-03-18 08:05:29 +00001009
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001010 for (size_t i = 0; i < n; i++) {
Kostya Serebryanye35d59a2013-01-24 10:43:50 +00001011 static const uint64_t kMaxGlobalRedzone = 1 << 18;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001012 GlobalVariable *G = GlobalsToChange[i];
1013 PointerType *PtrTy = cast<PointerType>(G->getType());
1014 Type *Ty = PtrTy->getElementType();
Rafael Espindola37dc9e12014-02-21 00:06:31 +00001015 uint64_t SizeInBytes = DL->getTypeAllocSize(Ty);
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001016 uint64_t MinRZ = MinRedzoneSizeForGlobal();
Kostya Serebryany87191f62013-01-24 10:35:40 +00001017 // MinRZ <= RZ <= kMaxGlobalRedzone
1018 // and trying to make RZ to be ~ 1/4 of SizeInBytes.
Kostya Serebryanye35d59a2013-01-24 10:43:50 +00001019 uint64_t RZ = std::max(MinRZ,
Kostya Serebryany87191f62013-01-24 10:35:40 +00001020 std::min(kMaxGlobalRedzone,
1021 (SizeInBytes / MinRZ / 4) * MinRZ));
1022 uint64_t RightRedzoneSize = RZ;
1023 // Round up to MinRZ
1024 if (SizeInBytes % MinRZ)
1025 RightRedzoneSize += MinRZ - (SizeInBytes % MinRZ);
1026 assert(((RightRedzoneSize + SizeInBytes) % MinRZ) == 0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001027 Type *RightRedZoneTy = ArrayType::get(IRB.getInt8Ty(), RightRedzoneSize);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001028 // Determine whether this global should be poisoned in initialization.
Kostya Serebryanyb3bd6052012-11-20 13:00:01 +00001029 bool GlobalHasDynamicInitializer =
1030 DynamicallyInitializedGlobals.Contains(G);
Kostya Serebryany2fa38f82012-09-05 07:29:56 +00001031 // Don't check initialization order if this global is blacklisted.
Peter Collingbourne49062a92013-07-09 22:03:17 +00001032 GlobalHasDynamicInitializer &= !BL->isIn(*G, "init");
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001033
1034 StructType *NewTy = StructType::get(Ty, RightRedZoneTy, NULL);
1035 Constant *NewInitializer = ConstantStruct::get(
1036 NewTy, G->getInitializer(),
1037 Constant::getNullValue(RightRedZoneTy), NULL);
1038
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +00001039 GlobalVariable *Name =
1040 createPrivateGlobalForString(M, G->getName(), /*AllowMerging*/true);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001041
1042 // Create a new global variable with enough space for a redzone.
Bill Wendling58f8cef2013-08-06 22:52:42 +00001043 GlobalValue::LinkageTypes Linkage = G->getLinkage();
1044 if (G->isConstant() && Linkage == GlobalValue::PrivateLinkage)
1045 Linkage = GlobalValue::InternalLinkage;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001046 GlobalVariable *NewGlobal = new GlobalVariable(
Bill Wendling58f8cef2013-08-06 22:52:42 +00001047 M, NewTy, G->isConstant(), Linkage,
Hans Wennborgcbe34b42012-06-23 11:37:03 +00001048 NewInitializer, "", G, G->getThreadLocalMode());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001049 NewGlobal->copyAttributesFrom(G);
Kostya Serebryany87191f62013-01-24 10:35:40 +00001050 NewGlobal->setAlignment(MinRZ);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001051
1052 Value *Indices2[2];
1053 Indices2[0] = IRB.getInt32(0);
1054 Indices2[1] = IRB.getInt32(0);
1055
1056 G->replaceAllUsesWith(
Kostya Serebryany7471d132012-01-28 04:27:16 +00001057 ConstantExpr::getGetElementPtr(NewGlobal, Indices2, true));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001058 NewGlobal->takeName(G);
1059 G->eraseFromParent();
1060
1061 Initializers[i] = ConstantStruct::get(
1062 GlobalStructTy,
1063 ConstantExpr::getPointerCast(NewGlobal, IntptrTy),
1064 ConstantInt::get(IntptrTy, SizeInBytes),
1065 ConstantInt::get(IntptrTy, SizeInBytes + RightRedzoneSize),
1066 ConstantExpr::getPointerCast(Name, IntptrTy),
Kostya Serebryanybd016bb2013-03-18 08:05:29 +00001067 ConstantExpr::getPointerCast(ModuleName, IntptrTy),
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001068 ConstantInt::get(IntptrTy, GlobalHasDynamicInitializer),
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001069 NULL);
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001070
1071 // Populate the first and last globals declared in this TU.
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00001072 if (CheckInitOrder && GlobalHasDynamicInitializer)
1073 HasDynamicallyInitializedGlobals = true;
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001074
Kostya Serebryany20343352012-10-17 13:40:06 +00001075 DEBUG(dbgs() << "NEW GLOBAL: " << *NewGlobal << "\n");
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001076 }
1077
1078 ArrayType *ArrayOfGlobalStructTy = ArrayType::get(GlobalStructTy, n);
1079 GlobalVariable *AllGlobals = new GlobalVariable(
Bill Wendling58f8cef2013-08-06 22:52:42 +00001080 M, ArrayOfGlobalStructTy, false, GlobalVariable::InternalLinkage,
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001081 ConstantArray::get(ArrayOfGlobalStructTy, Initializers), "");
1082
Kostya Serebryanyf4be0192012-08-21 08:24:25 +00001083 // Create calls for poisoning before initializers run and unpoisoning after.
Alexey Samsonove1e26bf2013-03-26 13:05:41 +00001084 if (CheckInitOrder && HasDynamicallyInitializedGlobals)
1085 createInitializerPoisonCalls(M, ModuleName);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001086 IRB.CreateCall2(AsanRegisterGlobals,
1087 IRB.CreatePointerCast(AllGlobals, IntptrTy),
1088 ConstantInt::get(IntptrTy, n));
1089
Kostya Serebryanycd1aba82011-12-15 21:59:03 +00001090 // We also need to unregister globals at the end, e.g. when a shared library
1091 // gets closed.
1092 Function *AsanDtorFunction = Function::Create(
1093 FunctionType::get(Type::getVoidTy(*C), false),
1094 GlobalValue::InternalLinkage, kAsanModuleDtorName, &M);
1095 BasicBlock *AsanDtorBB = BasicBlock::Create(*C, "", AsanDtorFunction);
1096 IRBuilder<> IRB_Dtor(ReturnInst::Create(*C, AsanDtorBB));
Kostya Serebryanycd1aba82011-12-15 21:59:03 +00001097 IRB_Dtor.CreateCall2(AsanUnregisterGlobals,
1098 IRB.CreatePointerCast(AllGlobals, IntptrTy),
1099 ConstantInt::get(IntptrTy, n));
1100 appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndCtorPriority);
1101
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001102 DEBUG(dbgs() << M);
1103 return true;
1104}
1105
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001106void AddressSanitizer::initializeCallbacks(Module &M) {
1107 IRBuilder<> IRB(*C);
Kostya Serebryany4273bb02012-07-16 14:09:42 +00001108 // Create __asan_report* callbacks.
1109 for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
1110 for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
1111 AccessSizeIndex++) {
1112 // IsWrite and TypeSize are encoded in the function name.
1113 std::string FunctionName = std::string(kAsanReportErrorTemplate) +
1114 (AccessIsWrite ? "store" : "load") + itostr(1 << AccessSizeIndex);
Kostya Serebryany986b8da2012-07-17 11:04:12 +00001115 // If we are merging crash callbacks, they have two parameters.
Kostya Serebryany157a5152012-11-07 12:42:18 +00001116 AsanErrorCallback[AccessIsWrite][AccessSizeIndex] =
1117 checkInterfaceFunction(M.getOrInsertFunction(
1118 FunctionName, IRB.getVoidTy(), IntptrTy, NULL));
Kostya Serebryany4273bb02012-07-16 14:09:42 +00001119 }
1120 }
Kostya Serebryany3ece9bea2013-02-19 11:29:21 +00001121 AsanErrorCallbackSized[0] = checkInterfaceFunction(M.getOrInsertFunction(
1122 kAsanReportLoadN, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
1123 AsanErrorCallbackSized[1] = checkInterfaceFunction(M.getOrInsertFunction(
1124 kAsanReportStoreN, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001125
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001126 AsanHandleNoReturnFunc = checkInterfaceFunction(M.getOrInsertFunction(
1127 kAsanHandleNoReturnName, IRB.getVoidTy(), NULL));
Bob Wilsonda4147c2013-11-15 07:16:09 +00001128 AsanCovFunction = checkInterfaceFunction(M.getOrInsertFunction(
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001129 kAsanCovName, IRB.getVoidTy(), NULL));
Kostya Serebryany796f6552014-02-27 12:45:36 +00001130 AsanPtrCmpFunction = checkInterfaceFunction(M.getOrInsertFunction(
1131 kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
1132 AsanPtrSubFunction = checkInterfaceFunction(M.getOrInsertFunction(
1133 kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
Kostya Serebryanyf02c6062012-07-20 09:54:50 +00001134 // We insert an empty inline asm after __asan_report* to avoid callback merge.
1135 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
1136 StringRef(""), StringRef(""),
1137 /*hasSideEffects=*/true);
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001138}
1139
1140// virtual
1141bool AddressSanitizer::doInitialization(Module &M) {
1142 // Initialize the private fields. No one has accessed them before.
Rafael Espindola93512512014-02-25 17:30:31 +00001143 DataLayoutPass *DLP = getAnalysisIfAvailable<DataLayoutPass>();
1144 if (!DLP)
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001145 return false;
Rafael Espindola93512512014-02-25 17:30:31 +00001146 DL = &DLP->getDataLayout();
1147
Alexey Samsonove4b5fb82013-08-12 11:46:09 +00001148 BL.reset(SpecialCaseList::createOrDie(BlacklistFile));
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001149 DynamicallyInitializedGlobals.Init(M);
1150
1151 C = &(M.getContext());
Rafael Espindola37dc9e12014-02-21 00:06:31 +00001152 LongSize = DL->getPointerSizeInBits();
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001153 IntptrTy = Type::getIntNTy(*C, LongSize);
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001154
1155 AsanCtorFunction = Function::Create(
1156 FunctionType::get(Type::getVoidTy(*C), false),
1157 GlobalValue::InternalLinkage, kAsanModuleCtorName, &M);
1158 BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction);
1159 // call __asan_init in the module ctor.
1160 IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB));
1161 AsanInitFunction = checkInterfaceFunction(
1162 M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), NULL));
1163 AsanInitFunction->setLinkage(Function::ExternalLinkage);
1164 IRB.CreateCall(AsanInitFunction);
Kostya Serebryany4273bb02012-07-16 14:09:42 +00001165
Evgeniy Stepanov13665362014-01-16 10:19:12 +00001166 Mapping = getShadowMapping(M, LongSize);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001167
Kostya Serebryanycd1aba82011-12-15 21:59:03 +00001168 appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndCtorPriority);
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001169 return true;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001170}
1171
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +00001172bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
1173 // For each NSObject descendant having a +load method, this method is invoked
1174 // by the ObjC runtime before any of the static constructors is called.
1175 // Therefore we need to instrument such methods with a call to __asan_init
1176 // at the beginning in order to initialize our runtime before any access to
1177 // the shadow memory.
1178 // We cannot just ignore these methods, because they may call other
1179 // instrumented functions.
1180 if (F.getName().find(" load]") != std::string::npos) {
1181 IRBuilder<> IRB(F.begin()->begin());
1182 IRB.CreateCall(AsanInitFunction);
1183 return true;
1184 }
1185 return false;
1186}
1187
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001188void AddressSanitizer::InjectCoverageAtBlock(Function &F, BasicBlock &BB) {
1189 BasicBlock::iterator IP = BB.getFirstInsertionPt(), BE = BB.end();
Reid Kleckner30b2a9a2013-12-10 21:49:28 +00001190 // Skip static allocas at the top of the entry block so they don't become
1191 // dynamic when we split the block. If we used our optimized stack layout,
1192 // then there will only be one alloca and it will come first.
Reid Kleckner30b2a9a2013-12-10 21:49:28 +00001193 for (; IP != BE; ++IP) {
1194 AllocaInst *AI = dyn_cast<AllocaInst>(IP);
1195 if (!AI || !AI->isStaticAlloca())
1196 break;
1197 }
1198
1199 IRBuilder<> IRB(IP);
Bob Wilsonda4147c2013-11-15 07:16:09 +00001200 Type *Int8Ty = IRB.getInt8Ty();
1201 GlobalVariable *Guard = new GlobalVariable(
Kostya Serebryany0604c622013-11-15 09:52:05 +00001202 *F.getParent(), Int8Ty, false, GlobalValue::PrivateLinkage,
Bob Wilsonda4147c2013-11-15 07:16:09 +00001203 Constant::getNullValue(Int8Ty), "__asan_gen_cov_" + F.getName());
1204 LoadInst *Load = IRB.CreateLoad(Guard);
1205 Load->setAtomic(Monotonic);
1206 Load->setAlignment(1);
1207 Value *Cmp = IRB.CreateICmpEQ(Constant::getNullValue(Int8Ty), Load);
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001208 Instruction *Ins = SplitBlockAndInsertIfThen(
1209 Cmp, IP, false, MDBuilder(*C).createBranchWeights(1, 100000));
Bob Wilsonda4147c2013-11-15 07:16:09 +00001210 IRB.SetInsertPoint(Ins);
1211 // We pass &F to __sanitizer_cov. We could avoid this and rely on
1212 // GET_CALLER_PC, but having the PC of the first instruction is just nice.
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001213 Instruction *Call = IRB.CreateCall(AsanCovFunction);
1214 Call->setDebugLoc(IP->getDebugLoc());
Bob Wilsonda4147c2013-11-15 07:16:09 +00001215 StoreInst *Store = IRB.CreateStore(ConstantInt::get(Int8Ty, 1), Guard);
1216 Store->setAtomic(Monotonic);
1217 Store->setAlignment(1);
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001218}
1219
1220// Poor man's coverage that works with ASan.
1221// We create a Guard boolean variable with the same linkage
1222// as the function and inject this code into the entry block (-asan-coverage=1)
1223// or all blocks (-asan-coverage=2):
1224// if (*Guard) {
1225// __sanitizer_cov(&F);
1226// *Guard = 1;
1227// }
1228// The accesses to Guard are atomic. The rest of the logic is
1229// in __sanitizer_cov (it's fine to call it more than once).
1230//
1231// This coverage implementation provides very limited data:
1232// it only tells if a given function (block) was ever executed.
1233// No counters, no per-edge data.
1234// But for many use cases this is what we need and the added slowdown
1235// is negligible. This simple implementation will probably be obsoleted
1236// by the upcoming Clang-based coverage implementation.
1237// By having it here and now we hope to
1238// a) get the functionality to users earlier and
1239// b) collect usage statistics to help improve Clang coverage design.
1240bool AddressSanitizer::InjectCoverage(Function &F,
1241 const ArrayRef<BasicBlock *> AllBlocks) {
1242 if (!ClCoverage) return false;
1243
1244 if (ClCoverage == 1) {
1245 InjectCoverageAtBlock(F, F.getEntryBlock());
1246 } else {
1247 for (size_t i = 0, n = AllBlocks.size(); i < n; i++)
1248 InjectCoverageAtBlock(F, *AllBlocks[i]);
1249 }
Bob Wilsonda4147c2013-11-15 07:16:09 +00001250 return true;
1251}
1252
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001253bool AddressSanitizer::runOnFunction(Function &F) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001254 if (BL->isIn(F)) return false;
1255 if (&F == AsanCtorFunction) return false;
Kostya Serebryany6b5b58d2013-03-18 07:33:49 +00001256 if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false;
Kostya Serebryany20343352012-10-17 13:40:06 +00001257 DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n");
Kostya Serebryany4b929da2012-11-29 09:54:21 +00001258 initializeCallbacks(*F.getParent());
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +00001259
Kostya Serebryanycf880b92013-02-26 06:58:09 +00001260 // If needed, insert __asan_init before checking for SanitizeAddress attr.
Kostya Serebryany22ddcfd2012-01-30 23:50:10 +00001261 maybeInsertAsanInitAtFunctionEntry(F);
1262
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001263 if (!F.hasFnAttribute(Attribute::SanitizeAddress))
Bill Wendlingc9b22d72012-10-09 07:45:08 +00001264 return false;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001265
1266 if (!ClDebugFunc.empty() && ClDebugFunc != F.getName())
1267 return false;
Bill Wendlingc9b22d72012-10-09 07:45:08 +00001268
1269 // We want to instrument every address only once per basic block (unless there
1270 // are calls between uses).
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001271 SmallSet<Value*, 16> TempsToInstrument;
1272 SmallVector<Instruction*, 16> ToInstrument;
Kostya Serebryany154a54d2012-02-08 21:36:17 +00001273 SmallVector<Instruction*, 8> NoReturnCalls;
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001274 SmallVector<BasicBlock*, 16> AllBlocks;
Kostya Serebryany796f6552014-02-27 12:45:36 +00001275 SmallVector<Instruction*, 16> PointerComparisonsOrSubtracts;
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001276 int NumAllocas = 0;
Kostya Serebryany90241602012-05-30 09:04:06 +00001277 bool IsWrite;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001278
1279 // Fill the set of memory operations to instrument.
1280 for (Function::iterator FI = F.begin(), FE = F.end();
1281 FI != FE; ++FI) {
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001282 AllBlocks.push_back(FI);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001283 TempsToInstrument.clear();
Kostya Serebryanyc387ca72012-06-28 09:34:41 +00001284 int NumInsnsPerBB = 0;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001285 for (BasicBlock::iterator BI = FI->begin(), BE = FI->end();
1286 BI != BE; ++BI) {
Kostya Serebryany687d0782012-01-11 18:15:23 +00001287 if (LooksLikeCodeInBug11395(BI)) return false;
Kostya Serebryany90241602012-05-30 09:04:06 +00001288 if (Value *Addr = isInterestingMemoryAccess(BI, &IsWrite)) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001289 if (ClOpt && ClOptSameTemp) {
1290 if (!TempsToInstrument.insert(Addr))
1291 continue; // We've seen this temp in the current BB.
1292 }
Kostya Serebryanycb3f6e12014-02-27 13:13:59 +00001293 } else if (ClInvalidPointerPairs &&
Kostya Serebryany796f6552014-02-27 12:45:36 +00001294 isInterestingPointerComparisonOrSubtraction(BI)) {
1295 PointerComparisonsOrSubtracts.push_back(BI);
1296 continue;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001297 } else if (isa<MemIntrinsic>(BI) && ClMemIntrin) {
1298 // ok, take it.
1299 } else {
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001300 if (isa<AllocaInst>(BI))
1301 NumAllocas++;
Kostya Serebryany699ac282013-02-20 12:35:15 +00001302 CallSite CS(BI);
1303 if (CS) {
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001304 // A call inside BB.
1305 TempsToInstrument.clear();
Kostya Serebryany699ac282013-02-20 12:35:15 +00001306 if (CS.doesNotReturn())
1307 NoReturnCalls.push_back(CS.getInstruction());
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001308 }
1309 continue;
1310 }
1311 ToInstrument.push_back(BI);
Kostya Serebryanyc387ca72012-06-28 09:34:41 +00001312 NumInsnsPerBB++;
1313 if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB)
1314 break;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001315 }
1316 }
1317
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001318 Function *UninstrumentedDuplicate = 0;
1319 bool LikelyToInstrument =
1320 !NoReturnCalls.empty() || !ToInstrument.empty() || (NumAllocas > 0);
1321 if (ClKeepUninstrumented && LikelyToInstrument) {
1322 ValueToValueMapTy VMap;
1323 UninstrumentedDuplicate = CloneFunction(&F, VMap, false);
1324 UninstrumentedDuplicate->removeFnAttr(Attribute::SanitizeAddress);
1325 UninstrumentedDuplicate->setName("NOASAN_" + F.getName());
1326 F.getParent()->getFunctionList().push_back(UninstrumentedDuplicate);
1327 }
1328
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001329 // Instrument.
1330 int NumInstrumented = 0;
1331 for (size_t i = 0, n = ToInstrument.size(); i != n; i++) {
1332 Instruction *Inst = ToInstrument[i];
1333 if (ClDebugMin < 0 || ClDebugMax < 0 ||
1334 (NumInstrumented >= ClDebugMin && NumInstrumented <= ClDebugMax)) {
Kostya Serebryany90241602012-05-30 09:04:06 +00001335 if (isInterestingMemoryAccess(Inst, &IsWrite))
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001336 instrumentMop(Inst);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001337 else
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001338 instrumentMemIntrinsic(cast<MemIntrinsic>(Inst));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001339 }
1340 NumInstrumented++;
1341 }
1342
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001343 FunctionStackPoisoner FSP(F, *this);
1344 bool ChangedStack = FSP.runOnFunction();
Kostya Serebryany154a54d2012-02-08 21:36:17 +00001345
1346 // We must unpoison the stack before every NoReturn call (throw, _exit, etc).
1347 // See e.g. http://code.google.com/p/address-sanitizer/issues/detail?id=37
1348 for (size_t i = 0, n = NoReturnCalls.size(); i != n; i++) {
1349 Instruction *CI = NoReturnCalls[i];
1350 IRBuilder<> IRB(CI);
Kostya Serebryanyb0e25062012-10-15 14:20:06 +00001351 IRB.CreateCall(AsanHandleNoReturnFunc);
Kostya Serebryany154a54d2012-02-08 21:36:17 +00001352 }
1353
Kostya Serebryany796f6552014-02-27 12:45:36 +00001354 for (size_t i = 0, n = PointerComparisonsOrSubtracts.size(); i != n; i++) {
1355 instrumentPointerComparisonOrSubtraction(PointerComparisonsOrSubtracts[i]);
1356 NumInstrumented++;
1357 }
1358
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001359 bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty();
Bob Wilsonda4147c2013-11-15 07:16:09 +00001360
Kostya Serebryany714c67c2014-01-17 11:00:30 +00001361 if (InjectCoverage(F, AllBlocks))
Bob Wilsonda4147c2013-11-15 07:16:09 +00001362 res = true;
1363
Kostya Serebryany9f5213f2013-06-26 09:18:17 +00001364 DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n");
1365
1366 if (ClKeepUninstrumented) {
1367 if (!res) {
1368 // No instrumentation is done, no need for the duplicate.
1369 if (UninstrumentedDuplicate)
1370 UninstrumentedDuplicate->eraseFromParent();
1371 } else {
1372 // The function was instrumented. We must have the duplicate.
1373 assert(UninstrumentedDuplicate);
1374 UninstrumentedDuplicate->setSection("NOASAN");
1375 assert(!F.hasSection());
1376 F.setSection("ASAN");
1377 }
1378 }
1379
1380 return res;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001381}
1382
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001383// Workaround for bug 11395: we don't want to instrument stack in functions
1384// with large assembly blobs (32-bit only), otherwise reg alloc may crash.
1385// FIXME: remove once the bug 11395 is fixed.
1386bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
1387 if (LongSize != 32) return false;
1388 CallInst *CI = dyn_cast<CallInst>(I);
1389 if (!CI || !CI->isInlineAsm()) return false;
1390 if (CI->getNumArgOperands() <= 5) return false;
1391 // We have inline assembly with quite a few arguments.
1392 return true;
1393}
1394
1395void FunctionStackPoisoner::initializeCallbacks(Module &M) {
1396 IRBuilder<> IRB(*C);
Kostya Serebryany6805de52013-09-10 13:16:56 +00001397 for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
1398 std::string Suffix = itostr(i);
1399 AsanStackMallocFunc[i] = checkInterfaceFunction(
1400 M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy,
1401 IntptrTy, IntptrTy, NULL));
1402 AsanStackFreeFunc[i] = checkInterfaceFunction(M.getOrInsertFunction(
1403 kAsanStackFreeNameTemplate + Suffix, IRB.getVoidTy(), IntptrTy,
1404 IntptrTy, IntptrTy, NULL));
1405 }
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001406 AsanPoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction(
1407 kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
1408 AsanUnpoisonStackMemoryFunc = checkInterfaceFunction(M.getOrInsertFunction(
1409 kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy, NULL));
1410}
1411
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001412void
1413FunctionStackPoisoner::poisonRedZones(const ArrayRef<uint8_t> ShadowBytes,
1414 IRBuilder<> &IRB, Value *ShadowBase,
1415 bool DoPoison) {
1416 size_t n = ShadowBytes.size();
Kostya Serebryanyff7bde12013-12-23 09:24:36 +00001417 size_t i = 0;
1418 // We need to (un)poison n bytes of stack shadow. Poison as many as we can
1419 // using 64-bit stores (if we are on 64-bit arch), then poison the rest
1420 // with 32-bit stores, then with 16-byte stores, then with 8-byte stores.
1421 for (size_t LargeStoreSizeInBytes = ASan.LongSize / 8;
1422 LargeStoreSizeInBytes != 0; LargeStoreSizeInBytes /= 2) {
1423 for (; i + LargeStoreSizeInBytes - 1 < n; i += LargeStoreSizeInBytes) {
1424 uint64_t Val = 0;
1425 for (size_t j = 0; j < LargeStoreSizeInBytes; j++) {
Rafael Espindola37dc9e12014-02-21 00:06:31 +00001426 if (ASan.DL->isLittleEndian())
Kostya Serebryanyff7bde12013-12-23 09:24:36 +00001427 Val |= (uint64_t)ShadowBytes[i + j] << (8 * j);
1428 else
1429 Val = (Val << 8) | ShadowBytes[i + j];
1430 }
1431 if (!Val) continue;
1432 Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
1433 Type *StoreTy = Type::getIntNTy(*C, LargeStoreSizeInBytes * 8);
1434 Value *Poison = ConstantInt::get(StoreTy, DoPoison ? Val : 0);
1435 IRB.CreateStore(Poison, IRB.CreateIntToPtr(Ptr, StoreTy->getPointerTo()));
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001436 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001437 }
1438}
1439
Kostya Serebryany6805de52013-09-10 13:16:56 +00001440// Fake stack allocator (asan_fake_stack.h) has 11 size classes
1441// for every power of 2 from kMinStackMallocSize to kMaxAsanStackMallocSizeClass
1442static int StackMallocSizeClass(uint64_t LocalStackSize) {
1443 assert(LocalStackSize <= kMaxStackMallocSize);
1444 uint64_t MaxSize = kMinStackMallocSize;
1445 for (int i = 0; ; i++, MaxSize *= 2)
1446 if (LocalStackSize <= MaxSize)
1447 return i;
1448 llvm_unreachable("impossible LocalStackSize");
1449}
1450
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00001451// Set Size bytes starting from ShadowBase to kAsanStackAfterReturnMagic.
1452// We can not use MemSet intrinsic because it may end up calling the actual
1453// memset. Size is a multiple of 8.
1454// Currently this generates 8-byte stores on x86_64; it may be better to
1455// generate wider stores.
1456void FunctionStackPoisoner::SetShadowToStackAfterReturnInlined(
1457 IRBuilder<> &IRB, Value *ShadowBase, int Size) {
1458 assert(!(Size % 8));
1459 assert(kAsanStackAfterReturnMagic == 0xf5);
1460 for (int i = 0; i < Size; i += 8) {
1461 Value *p = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
1462 IRB.CreateStore(ConstantInt::get(IRB.getInt64Ty(), 0xf5f5f5f5f5f5f5f5ULL),
1463 IRB.CreateIntToPtr(p, IRB.getInt64Ty()->getPointerTo()));
1464 }
1465}
1466
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001467void FunctionStackPoisoner::poisonStack() {
Kostya Serebryany6805de52013-09-10 13:16:56 +00001468 int StackMallocIdx = -1;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001469
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001470 assert(AllocaVec.size() > 0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001471 Instruction *InsBefore = AllocaVec[0];
1472 IRBuilder<> IRB(InsBefore);
1473
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001474 SmallVector<ASanStackVariableDescription, 16> SVD;
1475 SVD.reserve(AllocaVec.size());
1476 for (size_t i = 0, n = AllocaVec.size(); i < n; i++) {
1477 AllocaInst *AI = AllocaVec[i];
1478 ASanStackVariableDescription D = { AI->getName().data(),
1479 getAllocaSizeInBytes(AI),
1480 AI->getAlignment(), AI, 0};
1481 SVD.push_back(D);
1482 }
1483 // Minimal header size (left redzone) is 4 pointers,
1484 // i.e. 32 bytes on 64-bit platforms and 16 bytes in 32-bit platforms.
1485 size_t MinHeaderSize = ASan.LongSize / 2;
1486 ASanStackFrameLayout L;
1487 ComputeASanStackFrameLayout(SVD, 1UL << Mapping.Scale, MinHeaderSize, &L);
1488 DEBUG(dbgs() << L.DescriptionString << " --- " << L.FrameSize << "\n");
1489 uint64_t LocalStackSize = L.FrameSize;
1490 bool DoStackMalloc =
1491 ASan.CheckUseAfterReturn && LocalStackSize <= kMaxStackMallocSize;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001492
1493 Type *ByteArrayTy = ArrayType::get(IRB.getInt8Ty(), LocalStackSize);
1494 AllocaInst *MyAlloca =
1495 new AllocaInst(ByteArrayTy, "MyAlloca", InsBefore);
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001496 assert((ClRealignStack & (ClRealignStack - 1)) == 0);
1497 size_t FrameAlignment = std::max(L.FrameAlignment, (size_t)ClRealignStack);
1498 MyAlloca->setAlignment(FrameAlignment);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001499 assert(MyAlloca->isStaticAlloca());
1500 Value *OrigStackBase = IRB.CreatePointerCast(MyAlloca, IntptrTy);
1501 Value *LocalStackBase = OrigStackBase;
1502
1503 if (DoStackMalloc) {
Kostya Serebryanyf3223822013-09-18 14:07:14 +00001504 // LocalStackBase = OrigStackBase
1505 // if (__asan_option_detect_stack_use_after_return)
1506 // LocalStackBase = __asan_stack_malloc_N(LocalStackBase, OrigStackBase);
Kostya Serebryany6805de52013-09-10 13:16:56 +00001507 StackMallocIdx = StackMallocSizeClass(LocalStackSize);
1508 assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
Kostya Serebryanyf3223822013-09-18 14:07:14 +00001509 Constant *OptionDetectUAR = F.getParent()->getOrInsertGlobal(
1510 kAsanOptionDetectUAR, IRB.getInt32Ty());
1511 Value *Cmp = IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUAR),
1512 Constant::getNullValue(IRB.getInt32Ty()));
Evgeniy Stepanova9164e92013-12-19 13:29:56 +00001513 Instruction *Term = SplitBlockAndInsertIfThen(Cmp, InsBefore, false);
Kostya Serebryanyf3223822013-09-18 14:07:14 +00001514 BasicBlock *CmpBlock = cast<Instruction>(Cmp)->getParent();
1515 IRBuilder<> IRBIf(Term);
1516 LocalStackBase = IRBIf.CreateCall2(
1517 AsanStackMallocFunc[StackMallocIdx],
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001518 ConstantInt::get(IntptrTy, LocalStackSize), OrigStackBase);
Kostya Serebryanyf3223822013-09-18 14:07:14 +00001519 BasicBlock *SetBlock = cast<Instruction>(LocalStackBase)->getParent();
1520 IRB.SetInsertPoint(InsBefore);
1521 PHINode *Phi = IRB.CreatePHI(IntptrTy, 2);
1522 Phi->addIncoming(OrigStackBase, CmpBlock);
1523 Phi->addIncoming(LocalStackBase, SetBlock);
1524 LocalStackBase = Phi;
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001525 }
1526
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001527 // Insert poison calls for lifetime intrinsics for alloca.
1528 bool HavePoisonedAllocas = false;
1529 for (size_t i = 0, n = AllocaPoisonCallVec.size(); i < n; i++) {
1530 const AllocaPoisonCall &APC = AllocaPoisonCallVec[i];
Alexey Samsonova788b942013-11-18 14:53:55 +00001531 assert(APC.InsBefore);
1532 assert(APC.AI);
1533 IRBuilder<> IRB(APC.InsBefore);
1534 poisonAlloca(APC.AI, APC.Size, IRB, APC.DoPoison);
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001535 HavePoisonedAllocas |= APC.DoPoison;
1536 }
1537
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001538 // Replace Alloca instructions with base+offset.
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001539 for (size_t i = 0, n = SVD.size(); i < n; i++) {
1540 AllocaInst *AI = SVD[i].AI;
Alexey Samsonov261177a2012-12-04 01:34:23 +00001541 Value *NewAllocaPtr = IRB.CreateIntToPtr(
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001542 IRB.CreateAdd(LocalStackBase,
1543 ConstantInt::get(IntptrTy, SVD[i].Offset)),
1544 AI->getType());
Alexey Samsonov3d43b632012-12-12 14:31:53 +00001545 replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB);
Alexey Samsonov261177a2012-12-04 01:34:23 +00001546 AI->replaceAllUsesWith(NewAllocaPtr);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001547 }
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001548
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00001549 // The left-most redzone has enough space for at least 4 pointers.
1550 // Write the Magic value to redzone[0].
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001551 Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
1552 IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic),
1553 BasePlus0);
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00001554 // Write the frame description constant to redzone[1].
1555 Value *BasePlus1 = IRB.CreateIntToPtr(
1556 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, ASan.LongSize/8)),
1557 IntptrPtrTy);
Alexey Samsonov9bdb63a2012-11-02 12:20:34 +00001558 GlobalVariable *StackDescriptionGlobal =
Alexander Potapenkodaf96ae2013-12-25 14:22:15 +00001559 createPrivateGlobalForString(*F.getParent(), L.DescriptionString,
1560 /*AllowMerging*/true);
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001561 Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal,
1562 IntptrTy);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001563 IRB.CreateStore(Description, BasePlus1);
Kostya Serebryanycdd35a92013-03-22 10:37:20 +00001564 // Write the PC to redzone[2].
1565 Value *BasePlus2 = IRB.CreateIntToPtr(
1566 IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy,
1567 2 * ASan.LongSize/8)),
1568 IntptrPtrTy);
1569 IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001570
1571 // Poison the stack redzones at the entry.
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001572 Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
Kostya Serebryany4fb78012013-12-06 09:00:17 +00001573 poisonRedZones(L.ShadowBytes, IRB, ShadowBase, true);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001574
Kostya Serebryany530e2072013-12-23 14:15:08 +00001575 // (Un)poison the stack before all ret instructions.
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001576 for (size_t i = 0, n = RetVec.size(); i < n; i++) {
1577 Instruction *Ret = RetVec[i];
1578 IRBuilder<> IRBRet(Ret);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001579 // Mark the current frame as retired.
1580 IRBRet.CreateStore(ConstantInt::get(IntptrTy, kRetiredStackFrameMagic),
1581 BasePlus0);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001582 if (DoStackMalloc) {
Kostya Serebryany6805de52013-09-10 13:16:56 +00001583 assert(StackMallocIdx >= 0);
Kostya Serebryany530e2072013-12-23 14:15:08 +00001584 // if LocalStackBase != OrigStackBase:
1585 // // In use-after-return mode, poison the whole stack frame.
1586 // if StackMallocIdx <= 4
1587 // // For small sizes inline the whole thing:
1588 // memset(ShadowBase, kAsanStackAfterReturnMagic, ShadowSize);
1589 // **SavedFlagPtr(LocalStackBase) = 0
1590 // else
1591 // __asan_stack_free_N(LocalStackBase, OrigStackBase)
1592 // else
1593 // <This is not a fake stack; unpoison the redzones>
1594 Value *Cmp = IRBRet.CreateICmpNE(LocalStackBase, OrigStackBase);
1595 TerminatorInst *ThenTerm, *ElseTerm;
1596 SplitBlockAndInsertIfThenElse(Cmp, Ret, &ThenTerm, &ElseTerm);
1597
1598 IRBuilder<> IRBPoison(ThenTerm);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00001599 if (StackMallocIdx <= 4) {
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00001600 int ClassSize = kMinStackMallocSize << StackMallocIdx;
1601 SetShadowToStackAfterReturnInlined(IRBPoison, ShadowBase,
1602 ClassSize >> Mapping.Scale);
1603 Value *SavedFlagPtrPtr = IRBPoison.CreateAdd(
1604 LocalStackBase,
1605 ConstantInt::get(IntptrTy, ClassSize - ASan.LongSize / 8));
1606 Value *SavedFlagPtr = IRBPoison.CreateLoad(
1607 IRBPoison.CreateIntToPtr(SavedFlagPtrPtr, IntptrPtrTy));
1608 IRBPoison.CreateStore(
1609 Constant::getNullValue(IRBPoison.getInt8Ty()),
1610 IRBPoison.CreateIntToPtr(SavedFlagPtr, IRBPoison.getInt8PtrTy()));
1611 } else {
1612 // For larger frames call __asan_stack_free_*.
Kostya Serebryany530e2072013-12-23 14:15:08 +00001613 IRBPoison.CreateCall3(AsanStackFreeFunc[StackMallocIdx], LocalStackBase,
1614 ConstantInt::get(IntptrTy, LocalStackSize),
1615 OrigStackBase);
Kostya Serebryanybc86efb2013-09-17 12:14:50 +00001616 }
Kostya Serebryany530e2072013-12-23 14:15:08 +00001617
1618 IRBuilder<> IRBElse(ElseTerm);
1619 poisonRedZones(L.ShadowBytes, IRBElse, ShadowBase, false);
Alexey Samsonov261177a2012-12-04 01:34:23 +00001620 } else if (HavePoisonedAllocas) {
1621 // If we poisoned some allocas in llvm.lifetime analysis,
1622 // unpoison whole stack frame now.
1623 assert(LocalStackBase == OrigStackBase);
1624 poisonAlloca(LocalStackBase, LocalStackSize, IRBRet, false);
Kostya Serebryany530e2072013-12-23 14:15:08 +00001625 } else {
1626 poisonRedZones(L.ShadowBytes, IRBRet, ShadowBase, false);
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001627 }
1628 }
1629
Kostya Serebryany09959942012-10-19 06:20:53 +00001630 // We are done. Remove the old unused alloca instructions.
1631 for (size_t i = 0, n = AllocaVec.size(); i < n; i++)
1632 AllocaVec[i]->eraseFromParent();
Kostya Serebryany6e6b03e2011-11-16 01:35:23 +00001633}
Alexey Samsonov261177a2012-12-04 01:34:23 +00001634
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001635void FunctionStackPoisoner::poisonAlloca(Value *V, uint64_t Size,
Jakub Staszak23ec6a92013-08-09 20:53:48 +00001636 IRBuilder<> &IRB, bool DoPoison) {
Alexey Samsonov261177a2012-12-04 01:34:23 +00001637 // For now just insert the call to ASan runtime.
1638 Value *AddrArg = IRB.CreatePointerCast(V, IntptrTy);
1639 Value *SizeArg = ConstantInt::get(IntptrTy, Size);
1640 IRB.CreateCall2(DoPoison ? AsanPoisonStackMemoryFunc
1641 : AsanUnpoisonStackMemoryFunc,
1642 AddrArg, SizeArg);
1643}
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001644
1645// Handling llvm.lifetime intrinsics for a given %alloca:
1646// (1) collect all llvm.lifetime.xxx(%size, %value) describing the alloca.
1647// (2) if %size is constant, poison memory for llvm.lifetime.end (to detect
1648// invalid accesses) and unpoison it for llvm.lifetime.start (the memory
1649// could be poisoned by previous llvm.lifetime.end instruction, as the
1650// variable may go in and out of scope several times, e.g. in loops).
1651// (3) if we poisoned at least one %alloca in a function,
1652// unpoison the whole stack frame at function exit.
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001653
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001654AllocaInst *FunctionStackPoisoner::findAllocaForValue(Value *V) {
1655 if (AllocaInst *AI = dyn_cast<AllocaInst>(V))
1656 // We're intested only in allocas we can handle.
1657 return isInterestingAlloca(*AI) ? AI : 0;
1658 // See if we've already calculated (or started to calculate) alloca for a
1659 // given value.
1660 AllocaForValueMapTy::iterator I = AllocaForValue.find(V);
1661 if (I != AllocaForValue.end())
1662 return I->second;
1663 // Store 0 while we're calculating alloca for value V to avoid
1664 // infinite recursion if the value references itself.
1665 AllocaForValue[V] = 0;
1666 AllocaInst *Res = 0;
1667 if (CastInst *CI = dyn_cast<CastInst>(V))
1668 Res = findAllocaForValue(CI->getOperand(0));
1669 else if (PHINode *PN = dyn_cast<PHINode>(V)) {
1670 for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) {
1671 Value *IncValue = PN->getIncomingValue(i);
1672 // Allow self-referencing phi-nodes.
1673 if (IncValue == PN) continue;
1674 AllocaInst *IncValueAI = findAllocaForValue(IncValue);
1675 // AI for incoming values should exist and should all be equal.
1676 if (IncValueAI == 0 || (Res != 0 && IncValueAI != Res))
1677 return 0;
1678 Res = IncValueAI;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001679 }
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001680 }
Alexey Samsonov29dd7f22012-12-27 08:50:58 +00001681 if (Res != 0)
1682 AllocaForValue[V] = Res;
Alexey Samsonov1e3f7ba2012-12-25 12:04:36 +00001683 return Res;
1684}